CVE-2025-62849

Dec. 17, 2025, 1:49 p.m.

5.2
Medium

Description

An SQL injection vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3297 build 20251024 and later QuTS hero h5.2.7.3297 build 20251024 and later QuTS hero h5.3.1.3292 build 20251024 and later

Product(s) Impacted

Vendor Product Versions
Qnap
  • Qts
  • Quts Hero
  • 5.2.0.2737, 5.2.0.2744, 5.2.0.2782, 5.2.0.2802, 5.2.0.2823, 5.2.0.2851, 5.2.0.2860, 5.2.1.2930, 5.2.2.2950, 5.2.3.3006, 5.2.4.3070, 5.2.4.3079, 5.2.4.3092, 5.2.5.3145, 5.2.6.3195, 5.2.6.3229, 5.2.7.3256
  • h5.2.0.2737, h5.2.0.2782, h5.2.0.2789, h5.2.0.2802, h5.2.0.2823, h5.2.0.2851, h5.2.0.2860, h5.2.1.2929, h5.2.1.2940, h5.2.2.2952, h5.2.3.3006, h5.2.4.3070, h5.2.4.3079, h5.2.5.3138, h5.2.6.3195, h5.2.7.3256, h5.3.0.3115, h5.3.0.3145, h5.3.0.3192, h5.3.1.3250

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
o qnap qts 5.2.0.2737 build_20240417 / / / / / /
o qnap qts 5.2.0.2744 build_20240424 / / / / / /
o qnap qts 5.2.0.2782 build_20240601 / / / / / /
o qnap qts 5.2.0.2802 build_20240620 / / / / / /
o qnap qts 5.2.0.2823 build_20240711 / / / / / /
o qnap qts 5.2.0.2851 build_20240808 / / / / / /
o qnap qts 5.2.0.2860 build_20240817 / / / / / /
o qnap qts 5.2.1.2930 build_20241025 / / / / / /
o qnap qts 5.2.2.2950 build_20241114 / / / / / /
o qnap qts 5.2.3.3006 build_20250108 / / / / / /
o qnap qts 5.2.4.3070 build_20250312 / / / / / /
o qnap qts 5.2.4.3079 build_20250321 / / / / / /
o qnap qts 5.2.4.3092 build_20250403 / / / / / /
o qnap qts 5.2.5.3145 build_20250526 / / / / / /
o qnap qts 5.2.6.3195 build_20250715 / / / / / /
o qnap qts 5.2.6.3229 build_20250818 / / / / / /
o qnap qts 5.2.7.3256 build_20250913 / / / / / /
o qnap quts_hero h5.2.0.2737 build_20240417 / / / / / /
o qnap quts_hero h5.2.0.2782 build_20240601 / / / / / /
o qnap quts_hero h5.2.0.2789 build_20240607 / / / / / /
o qnap quts_hero h5.2.0.2802 build_20240620 / / / / / /
o qnap quts_hero h5.2.0.2823 build_20240711 / / / / / /
o qnap quts_hero h5.2.0.2851 build_20240808 / / / / / /
o qnap quts_hero h5.2.0.2860 build_20240817 / / / / / /
o qnap quts_hero h5.2.1.2929 build_20241025 / / / / / /
o qnap quts_hero h5.2.1.2940 build_20241105 / / / / / /
o qnap quts_hero h5.2.2.2952 build_20241116 / / / / / /
o qnap quts_hero h5.2.3.3006 build_20250108 / / / / / /
o qnap quts_hero h5.2.4.3070 build_20250312 / / / / / /
o qnap quts_hero h5.2.4.3079 build_20250321 / / / / / /
o qnap quts_hero h5.2.5.3138 build_20250519 / / / / / /
o qnap quts_hero h5.2.6.3195 build_20250715 / / / / / /
o qnap quts_hero h5.2.7.3256 build_20250913 / / / / / /
o qnap quts_hero h5.3.0.3115 build_20250430 / / / / / /
o qnap quts_hero h5.3.0.3145 build_20250530 / / / / / /
o qnap quts_hero h5.3.0.3192 build_20250716 / / / / / /
o qnap quts_hero h5.3.1.3250 build_20250912 / / / / / /

References

https://www.qnap.com/en/security-advisory/qsa-25-45

Tags

security@qnapsecurity.com.tw
2025-12-16
CVE-2025-62849

CVSS Score

5.2 / 10

CVSS Data - 4.0

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Attack Requirements: PRESENT
  • Privileges Required: NONE
  • User Interaction: PASSIVE
  • Scope:
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH
  • Exploit Maturity: UNREPORTED

    • CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: Dec. 16, 2025, 3:15 a.m.
Last Modified: Dec. 17, 2025, 1:49 p.m.

Status : Analyzed

CVE has had analysis completed and all data associations made.

More info

Source

security@qnapsecurity.com.tw

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.